The DMZ

Rory Alsop

00:03

@LucasKauffman hmmmm - not really getting them, I'm afraid. I am mostly an old rocker, who also likes classical, flamenco, and most forms of music that aren't 'pop'

Rory McCune

06:54

@LucasKauffman @LucasKauffman yeah Got the tickets a while back so all sorted. Not too sure on the workshop front as yet, but I'll need to sort it out at the weekend so I can make sure I've got any pre-reqs' loaded...

AviD

07:11

w00t, my top scoring answer finally passed @ThomasPornin's answer on the same question.

'course its only his 4th or 5th top scoring answer, but still...

ah, oops - no, its only tied.

Terry Chia

@AviD passed now ;)

AviD

@TerryChia hahaha, you rock!!

to be fair I think @Thomas' answer is great too.

Terry Chia

@AviD Which answer of his isn't?

AviD

@Jeff's, not so much.

@TerryChia heh, actually I remember there were one or two.

Terry Chia

Man i'm getting bored of practicing red hat...

AviD

07:22

@TerryChia switch to black hat. it's more exciting.

Terry Chia

@AviD heh. rm -rf / ftw

AviD

rm -?

Terry Chia

@AviD -r = recursive, -f = force

Polynomial

won't work on any modern system, though

patched in coreutils

you have to do sudo rm -Rf /*

and it still warns you in large letters "THIS WILL DESTROY ALL DATA ON THIS SYSTEM - ARE YOU SURE YOU WISH TO CONTINUE?" several times.

Terry Chia

Heh. Makes sense they do that. It is too easy to want to delete a directory in "/" but press the enter key by accident.

Polynomial

07:34

yup

that's why I always cd to root if I want to delete something in there

well, I used to

I don't tend to as much these days, since the coreutils patch

Terry Chia

11:46

Will @Polynomial gain mod tools access sometime today? ;)

Polynomial

possibly ^^

Terry Chia

My rep gain this month is pretty low, only 327.

Guess i have been pretty busy lately.

Polynomial

mine's been significantly lower over the last month

mainly due to work

heh, 4 more upvotes and I break 10k ^_^

Terry Chia

@Polynomial There, got you that 10k. ;)

Polynomial

win :D

got me two nice answer badges too ^^

Terry Chia

11:53

Yep, i tried to upvote those with 9 votes heh.

Polynomial

lol, tut tut, abusing the rep system like that! shame on you :P

Terry Chia

@Polynomial The answers were deserving. ;)

Polynomial

^_^

Terry Chia

So i guess your next target is to surpass a mod in rep? Could probably pass Hendrik and @JeffFerland in another month eh.

Polynomial

hahahaha: security.stackexchange.com/…

OVER 9000!

Terry Chia

11:58

Polynomial

haha

Terry Chia

Phew, finally done revising. Hopefully I'll do well for my RHCSA certification tomorrow.

Thomas Pornin

12:33

@AviD I think I wrote it already (probably in the DMZ), but for that specific question, I believe that your answer is the most correct one, and should be the one which is accepted.

AviD

@ThomasPornin thanks - now if only we can get @Jeff's answer downvoted into oblivion

it already has more downvotes than I remember seeing on sec.se for any post, but unfortunately it also has a ridiculous amount of upvotes from the clueless, too.

Thomas Pornin

12:51

He, this morning, no upvote on the CRIME answer yet. Looks like it is finally drying up.

Polynomial

@ThomasPornin I'd upvote it again if I could ^_^

hit 10k rep and 50 bronze badges today ^_^

feel like a bawss :P

2

Terry Chia

50.. bronze.. badges?...

oh. 50 bronze badges in total. read that as "i earned 50 today"

Polynomial

haha

that'd be hilarious

but no

Terry Chia

you need that fanatic badge. ;)

Polynomial

I get it on October 22nd

should also get the Electorate gold badge by the end of the week

maybe next week, actually. depends.

I tend to vote more frequently these days

Iszi

13:08

@TerryChia Mine's coming on the 25th this month!

Rory Alsop

@Polynomial welcome to modlike powers :-)

3

Polynomial

mwahahaha

Iszi

@RoryAlsop Actually, isn't it more like modlike vision? AFAIK, the mod tools you get at 10k just let you see a lot more, in a lot more different ways. Oh, wait... there's that "handling flags" bit. When did that come in?

Rory Alsop

@AviD - did you see the discussion re thresholds for the competition? In the other room?

Well, I say discussion - my monologue, really

AviD

@RoryAlsop what OTHER room....

yes, and it seems you've got it. I didnt have much anything smart to add, so I didnt.

I finally figured out @ThomasPornin, and probably @Polynomial too.

3

aww, thats smushed. are there any markdown options to control the image size...?

Polynomial

13:20

@AviD Nope. As @RoryMcCune can attest, there's only one of me!

AviD

@Polynomial well, he only saw one of you...

Rory McCune

@AviD @Polynomial well only one of you went to the conf (darn ninja'd by Avid)

Rory Alsop

@AviD That guy can't be @Poly - the hair is all wrong :-)

Polynomial

lol

yeah, and he looks about twice my weight.

AviD

cheeks look about right

Polynomial

13:24

rofl

Not Invented Here is going on my comics list

Rory Alsop

@AviD cool

Scott Pack

13:59

@JeffFerland Ah. I have lists of questions for sysadmins, including the questions that we asked, but I was the last security person hired. I only remember two of the questions, one was "Describe the Order of Volatility" and the other was a 10-15 line code sample and I was asked to fine or discuss any potential problems with it.

>_<

Hi Guys, I had to get a 'hub' of fleabay, duly installed between Firewall & DSL Modem. Oh Dear..... At 3am this morning I was monitoring the excessive upstream traffic with Wireshark and found what I suspect is an authenticated RDP connection (from a Ukranian IP!) to one of the internal file servers -Gulp! Off to find a security consultant now........in London....Bill. — Bill 2 hours ago

jrg

Oops.

Digital Fire

Morning everyone.

Ok so this question security.stackexchange.com/questions/20441/… Has already started with a -1. How can I improve it?

Polynomial

s/Morning/Happy diurnal isomorphism/

@DigitalFire You're talking about rootkits, basically. The question is a dupe.

Digital Fire

Can you point me to a question so I can get the answers to those points I posted? I'll remove once I can get a reference to something.

Stack Exchange

Blog - Stack Exchange: AskPatents.com: A Stack Exchange To Prevent Bad Patents

Joel Spolsky on September 20, 2012

We’ve all heard the stories of seemingly trivial patents being used to mug technology companies. There was the patent on the “Interactive Web” which a troll named Eolas used to extract $521 million from Microsoft–until a jury in East Texas threw out the patents. There are the four patents Lodsys is using to send threatening letters to software developers everywhere–trivial patents that Google says never should have been granted, in fact, Google and Oracle have submitted mountains of prior art to show that the patents should be invalid. …

Polynomial

14:12

@DigitalFire This should give you a good idea about how rootkits work and why it's nearly impossible to remove them: security.stackexchange.com/questions/19264/…

@DigitalFire And the last part of the accepted answer here is pretty useful in answering more concisely: security.stackexchange.com/questions/10369/what-is-a-rootkit

Digital Fire

@Polynomial This second one is golden. Thank you.

So in regards to the last bit of the second post. SELinux removes the ability to mod the kernal?

Polynomial

no

SELinux provides improved access control to processes

a process might still exploit a kernel vulnerability, if the SELinux hasn't been configured to block the vulnerable mechanism (which might not even be possible, for a lot of kernel calls)

adric

Gah. The correct horse battery staple SE linked above is a deep deep rabbit hole.

Digital Fire

:sigh: I need to get some lower level coding under my belt.

I'm so interested in all this but my C coding sucks =/

Rory Alsop

14:28

@adric correct horse battery staple is a alien (or is that conjoining too many memes)

Thomas Pornin

@DigitalFire C makes sense if you know assembly.

Assembly makes sense if you know logic gates and circuits.

Circuits make sense if you know quantum physics.

Rory Alsop

@ThomasPornin Yep I got from VLSI circuit design, through assembly to C and C+ but never managed to fully grok the newfangled languages

adric

you can get pretty far into MAC and how SELinux tries to save the world without the C. You may need to learn their policy language or the tools that right it for you. Fedora has great tools for it.

Thomas Pornin

Quantum physics do not make sense.

adric

Bah, Bohrian interpretation poppycock.

I believe strongly that if I was smart enough to understand it Feyman explained all of it.

Feynman, rather

Thomas Pornin

14:32

@adric At the core of the Copenhagen interpretation is the idea that QM cannot make sense and that's the way of the World. We just have to accept it.

Polynomial

@ThomasPornin So that's why I'm good at asm...

adric

I'm all for Zen and acknowledging that human logic and reason can only get you so far ..

@ThomasPornin I defer to your wisdom and experience in this sir :)

Digital Fire

Man, no wonder I started smoking when I became a programmer. It all makes sense now.

Polynomial

@ThomasPornin More specifically, it's that it's counter-intuitive. It makes sense, it just doesn't make sense from our standard model of thought.

</pedantry>

Thomas Pornin

@RoryAlsop To grasp the inner workings of a language, try to implement a compiler or interpreter for it. That's my favourite method, and it works well (if painfully).

Jeff Ferland

14:38

@ScottPack Feels weird I never knew that term until yesterday

Rory Alsop

@ThomasPornin Aye - totally agree. I wrote my first 6809 Assembler in assembly code

Ninefingers

15:42

@RoryAlsop Well, if it helps, python is a set of refcounted memory addresses and a giant bundle of hashmaps internally - at least in CPython. All classes are dictionaries (hashmaps) and everything is a class (object) which basically has an address (refcounted) and a dictionary with associated properties. The interpreter translates syntax onto these dicts. Pretty magic, really. Ok I'm sure it's more complicated than that for some cases like lambdas and stuff... but you get the idea.

Anyway, how is everyone?

Scott Pack

@JeffFerland I didn't actually know the term when they asked, but when they explained what it was for I was able to answer it. I think that specific verbiage fits into the CISSP umbrella.

Jeff Ferland

16:00

@ScottPack Made sense to me when I looked it up yesterday. "Grab things that will vanish first"

1) cute girl, 2) memory from computer, etc.

Scott Pack

@JeffFerland Pretty much, yeah. For anyone who's ever done that kind of work it should be obvious. I kind of liked it on two levels.

1) If person knows the term then they came across it somehow which is probably a good thing, or if they don't then it can show how they react when confronted with new information.

2) If they actually understand what it means, then they probably have some kind of reasonable grasp of the concepts of data collection.

Rory Alsop

@ScottPack I hadn't heard of it at all, and I have dealt with that sort of stuff a lot in my forensics roles....

makes sense though - good name

Jeff Ferland

@AviD You want to have an option to tell markdown to behave correctly? BWAHAHAHA. My sides hurt.

Scott Pack

xkcd-map.rent-a-geek.de/#2/28.8/148.4

Rory Alsop

I want to belong to the "ORDER of VOLATILITY"

5

Scott Pack

16:04

@RoryAlsop Unlike a lot of those types of terms, it actually seems somewhat descriptive.

Rory Alsop

@ScottPack brilliant - although it shows two whales, not a whale and a houseplant, and they are blue whales, not sperm whales....

Jeff Ferland

@RoryAlsop You are now a member. You have become unstable. You have ceased to exist. We hope you had a wonderful time.

Scott Pack

@RoryAlsop That was exactly my first complaint as well. :)

Rory Alsop

@JeffFerland nice!

Scott Pack

And by "houseplant" you, of course, mean "a bowl of petunias".

Jeff Ferland

16:09

So, is it appropriate to basically consider the interview over if the candidate doesn't know how to use find for anything at all besides find [./] -name [...] ?

Scott Pack

16:32

Well that depends. Is it for an intern? :)

Jeff Ferland

17:00

@ScottPack Nope

Scott Pack

17:40

Probably less than ideal then.

@JeffFerland Here's a fun one. One of my standard Linux/Unix admin questions is, "Describe how you would determine which application is accessing a specific file."

Jeff Ferland

@ScottPack I like that.

Scott Pack

My favorite answer was one where the candidate started out with "I would first go to /proc...."

Rory Alsop

@ScottPack yeah, but I was on a call and couldn't sort out the words in my head while talking about information lifecycles :-)

Scott Pack

@RoryAlsop whah-whah-whah-

Jeff Ferland

22:59

Some wanker flagged comments from 6 months ago...

Lucas Kauffman

@JeffFerland what comments?

Jeff Ferland

One was nonsense, the other was a bit of snark that I just edited two words out of.

Transcript for